safe-global / safe-client-gateway / 38392915172

91%

push

github

fix(messages): keep the safe field in typed-data domains (#3603)

Adding a proposer to a nested Safe fails with 422 "Could not calculate messageHash". Since the delegate v3 migration, the web app signs the Safe Queue Service delegate typed data, whose EIP-712 domain has a non-standard `safe` field, and posts it as an off-chain message on the parent Safe. `_TypedDataDomainSchema` stripped unknown keys, so `domain.safe` was gone while `types.EIP712Domain` still listed it, and viem's `hashTypedData` threw `Address "undefined" is invalid`.

The schema now keeps `safe` as an optional, checksummed address. With the domain intact, viem's hash matches the client's delegate hash exactly (checked against the payload the web app sends). Messages without `safe` parse exactly as before: Zod 4 leaves out absent optional keys, so no existing output changes.

**Note for reviewers:** `domain.safe` is now forwarded as part of the message to the queue service (or the transaction service when the queue is off). It has to be, because the queue service needs the full domain to rebuild the hash the parent Safe owner signed. Reads also keep it, since `SafeQueueMessageSchema` reuses `TypedDataSchema`. Not verified: whether the queue service's `POST /api/v1/safes/:safe/messages` accepts a `safe` key in the domain. Draft until that is confirmed on staging.

Safe-shield threat analysis also uses `TypedDataSchema`, so it now receives the full domain instead of a stripped one.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

4635 of 5392 branches covered (85.96%)

Branch coverage included in aggregate %.

11742 of 12787 relevant lines covered (91.83%)

366.31 hits per line